Skip to content
NocleyeNocleye Docs

Downloads and verification

Binaries and SBOMs are published at releases.nocleye.com, each with a detached GPG signature. The container image is on Docker Hub. What each version contains is on its own page, the current one is v0.2.0-beta.

Latest release: v0.2.0-beta

Section titled “Latest release: v0.2.0-beta”

v0.2.0-betabeta

PlatformArchiveSignatureSBOM
Linux x86-64
linux-amd64		.tar.gz · 4.71 MB.tar.gz.asc.spdx.json · .asc
Linux ARM64
linux-arm64		.tar.gz · 4.22 MB.tar.gz.asc.spdx.json · .asc
macOS x86-64
darwin-amd64		.tar.gz · 4.75 MB.tar.gz.asc.spdx.json · .asc
macOS ARM64
darwin-arm64		.tar.gz · 4.36 MB.tar.gz.asc.spdx.json · .asc

Container image. Docker Hub · v0.2.0-beta · latest

docker pull nocleye/api-gateway:v0.2.0-beta

Image digest. sha256:a46406f7aaad47094e37bede16e9ee1e635e7cbfb21801209192490bd7159207

Image files. Digests (.asc) · SBOM linux-amd64: .spdx.json (.asc) · SBOM linux-arm64: .spdx.json (.asc)

Signing key. nocleye.asc, the public key that signed every file above.

Verify a download

Section titled “Verify a download”

Check the signature before you run a binary or pull an image. The steps use linux-amd64 as the example, so replace it with your platform.

  1. Download the files. The archive, its .asc signature and the signing key nocleye.asc.

    Terminal window
    VERSION=v0.2.0-beta
    PLATFORM=linux-amd64
    BASE=https://releases.nocleye.com/api-gateway/$VERSION
    NAME=nocleye-api-gateway-$VERSION-$PLATFORM
    

    curl -fLO "$BASE/nocleye.asc"
    curl -fLO "$BASE/$PLATFORM/$NAME.tar.gz"
    curl -fLO "$BASE/$PLATFORM/$NAME.tar.gz.asc"

  2. Import the key.

    Terminal window
    gpg --import nocleye.asc
    gpg --fingerprint

    Compare the fingerprint with one you got from a second source, such as an email from us, before you trust it.

  3. Verify the archive. The output must say Good signature.

    Terminal window
    gpg --verify "$NAME.tar.gz.asc" "$NAME.tar.gz"

  4. Unpack it.

    Terminal window
    tar -xzf "$NAME.tar.gz"

Verify the SBOM

Section titled “Verify the SBOM”

Each archive has an SPDX SBOM in JSON, signed the same way. It lists every package inside the binary, so you can scan it for known vulnerabilities.

Terminal window
curl -fLO "$BASE/$PLATFORM/$NAME.spdx.json"
curl -fLO "$BASE/$PLATFORM/$NAME.spdx.json.asc"
gpg --verify "$NAME.spdx.json.asc" "$NAME.spdx.json"

Any SPDX-aware scanner can read the file, for example grype sbom:./$NAME.spdx.json.

Verify the container image

Section titled “Verify the container image”

The image is on Docker Hub. It has no archive. A signed .digests file lists the digests, and there is one SBOM per architecture.

Terminal window
docker pull nocleye/api-gateway:$VERSION


IMAGE_BASE=$BASE/image/nocleye-api-gateway-image-$VERSION
curl -fLO "$IMAGE_BASE.digests"
curl -fLO "$IMAGE_BASE.digests.asc"
gpg --verify "$(basename "$IMAGE_BASE").digests.asc" "$(basename "$IMAGE_BASE").digests"


docker buildx imagetools inspect nocleye/api-gateway:$VERSION

Compare the Digest: line from the last command with the signed .digests file before you run the image.